18cee8bf9c11a8b5104edb042802e37c2e6d4e55918b3604b68dd520823902f6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 09:24

Target
2026-04-15_79e4d15b909bd71d6351841a58927fb4_cobalt-strike_icedid_satacom.exe
Size 1.1MB
Sample260415-lc2cbsdx4v
SHA256 18cee8bf9c11a8b5104edb042802e37c2e6d4e55918b3604b68dd520823902f6
MD5 79e4d15b909bd71d6351841a58927fb4
SHA1 60a52e8e68f02f59a858b450c4167580906bc08c
SHA512 427b3534be47437c43ff581490fae22dcb3a33c432f69c3e980c97a65202b278f0f3ee24abca2c7461fdd271e13e131320f98d569140d4f4f2383118a73f5831
SSDEEP 24576:50aBF4qGtQUr5nTFP+Lc9jFGIgEwQulylpRkIgd:53obnTFP+8G5EwxUkB
TLSH
T18435CF032D5757ABD4AEF433AA8198AEFEEC9220B9DF0472C731B71CCD254E1056A917
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4496	rtFFEB.tmp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4496	2076	2026-04-15_79e4d15b909bd71d6351841a58927fb4_cobalt-strike_icedid_satacom.exe	85
PID 4496 wrote to memory of 4248	4496	rtFFEB.tmp.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-04-15_79e4d15b909bd71d6351841a58927fb4_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_79e4d15b909bd71d6351841a58927fb4_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\rtFFEB.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\rtFFEB.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4248

rtFFEB.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\rtFFEB.tmp.exe
Size 1016KB
SHA256 a535f3fa2193d4e3a26a821377be186c34a427c86f24a88e8fb7816248641994
MD5 565c7da4e7fd1b9b0cfd255578ccd48d
SHA1 67ff23a0c986a67b0cce8c6e303d3dd9368be3f0
SHA512 5dc3aa29c228ce08aa485f972bc401bdc605e93221c2128703b7af3205de11c61fefd6fac9ab5451abb7780eb32c6c425e1ca9c65de4209695218ed773356c13
SSDEEP 24576:JE/da9apmfJw1ZT69OOK1nSJSj6O5ev2qDVygjnPKPPytkR3:J2dwHmn6DK4JSj6O5ev2qDVyQRO
TLSH
T12D258E1677A401E9D167C278C9624617EBB2F49523309BDF4790CEAA2F136E29F3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download